Vulnerability · Published Oct 23, 2020 · Assigned by eclipse
CVE-2020-27216
High 7.0
In plain English
A high-severity security flaw in Eclipse Jetty from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.0High
Exploit odds (30 days)4.4%top 8.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jetty9 | 9.4.33-1 | DEBIAN-CVE-2020-27216 |
| Debian:13 | jetty9 | 9.4.33-1 | DEBIAN-CVE-2020-27216 |
| Debian:14 | jetty9 | 9.4.33-1 | DEBIAN-CVE-2020-27216 |
| Maven | org.eclipse.jetty:jetty-webapp | 11.0.0.beta3 | GHSA-g3wg-6mcf-8jj6 |
| Maven | org.eclipse.jetty:jetty-webapp | 10.0.0.beta3 | GHSA-g3wg-6mcf-8jj6 |
| Maven | org.eclipse.jetty:jetty-webapp | 9.4.33.v20201020 | GHSA-g3wg-6mcf-8jj6 |
| Maven | org.mortbay.jetty:jetty-webapp | 11.0.0.beta3 | GHSA-g3wg-6mcf-8jj6 |
| Maven | org.mortbay.jetty:jetty-webapp | 10.0.0.beta3 | GHSA-g3wg-6mcf-8jj6 |
| Maven | org.mortbay.jetty:jetty-webapp | 9.4.33 | GHSA-g3wg-6mcf-8jj6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Eclipse Foundation | Eclipse Jetty | 1.0 to 9.4.32.v2020093010.0.0.alpha1 to 10.0.0.beta211.0.0.alpha1 to 11.0.0.beta2 |
Weakness: CWE-378, CWE-379
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921 x_refsource_CONFIRM
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053 x_refsource_CONFIRM
- [shiro-commits] 20201104 [GitHub] [shiro] coheigea opened a new pull request #262: Update Jetty to 9.4.33.v20201020 to fix CVE-2020-27216 mailing-list, x_refsource_MLIST
- [directory-commits] 20201104 [directory-server] branch master updated: Updating Jetty to 9.4.33 to fix CVE-2020-27216 mailing-list, x_refsource_MLIST
- [kafka-jira] 20201104 [GitHub] [kafka] niteshmor opened a new pull request #9556: MINOR: Update jetty to 9.4.33 mailing-list, x_refsource_MLIST
- [shiro-commits] 20201104 [GitHub] [shiro] fpapon merged pull request #262: Update Jetty to 9.4.33.v20201020 to fix CVE-2020-27216 mailing-list, x_refsource_MLIST
- [shiro-commits] 20201104 [shiro] branch master updated: Update Jetty to 9.4.33.v20201020 to fix CVE-2020-27216 mailing-list, x_refsource_MLIST
- [druid-commits] 20201106 [GitHub] [druid] suneet-s opened a new pull request #10563: Bump jetty to latest version mailing-list, x_refsource_MLIST
- [beam-issues] 20201110 [jira] [Updated] (BEAM-11227) Upgrade beam-vendor-grpc-1_26_0-0.3 to fix CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-dev] 20201123 Owasp test failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20201123 [jira] [Created] (ZOOKEEPER-4017) Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20201123 [GitHub] [zookeeper] anmolnar opened a new pull request #1549: ZOOKEEPER-4017. Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20201123 [jira] [Updated] (ZOOKEEPER-4017) Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-dev] 20201123 Re: Owasp test failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-dev] 20201123 [jira] [Created] (ZOOKEEPER-4017) Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20201123 [GitHub] [zookeeper] anmolnar commented on pull request #1549: ZOOKEEPER-4017. Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20201123 [GitHub] [zookeeper] ztzg commented on pull request #1549: ZOOKEEPER-4017. Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20201123 [GitHub] [zookeeper] eolivelli commented on pull request #1549: ZOOKEEPER-4017. Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20201124 [GitHub] [zookeeper] anmolnar edited a comment on pull request #1549: ZOOKEEPER-4017. Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20201124 [GitHub] [zookeeper] anmolnar commented on pull request #1549: ZOOKEEPER-4017. Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20201124 [GitHub] [zookeeper] asfgit closed pull request #1549: ZOOKEEPER-4017. Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-commits] 20201124 [zookeeper] branch master updated: ZOOKEEPER-4017: Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-commits] 20201124 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4017: Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-commits] 20201124 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4017: Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20201124 [jira] [Resolved] (ZOOKEEPER-4017) Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20201124 [jira] [Updated] (ZOOKEEPER-4017) Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-notifications] 20201124 [GitHub] [zookeeper] nkalmar commented on pull request #1549: ZOOKEEPER-4017. Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [felix-dev] 20201125 [jira] [Created] (FELIX-6364) Security vulnerability CVE-2020-27216 ,update jetty mailing-list, x_refsource_MLIST
- [felix-dev] 20201125 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #63: FELIX-6364 Security vulnerability CVE-2020-27216 ,update jetty mailing-list, x_refsource_MLIST
- [felix-dev] 20201125 [jira] [Updated] (FELIX-6364) Security vulnerability CVE-2020-27216 ,update jetty mailing-list, x_refsource_MLIST
- [felix-dev] 20201125 [GitHub] [felix-dev] cziegeler merged pull request #63: FELIX-6364 Security vulnerability CVE-2020-27216 ,update jetty mailing-list, x_refsource_MLIST
- [felix-dev] 20201125 [jira] [Resolved] (FELIX-6364) Security vulnerability CVE-2020-27216 ,update jetty mailing-list, x_refsource_MLIST
- [felix-commits] 20201125 [felix-dev] branch master updated: FELIX-6364 Security vulnerability CVE-2020-27216 , update jetty (#63) mailing-list, x_refsource_MLIST
- [felix-dev] 20201125 [jira] [Assigned] (FELIX-6364) Security vulnerability CVE-2020-27216 ,update jetty mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20201205 [jira] [Assigned] (ZOOKEEPER-4023) CLONE - Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20201205 [jira] [Created] (ZOOKEEPER-4023) CLONE - Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-issues] 20201205 [jira] [Updated] (ZOOKEEPER-4023) dependency-check:check failing - Jetty 9.4.34.v20201102 - CVE-2020-27218 mailing-list, x_refsource_MLIST
- [zookeeper-dev] 20201205 [jira] [Created] (ZOOKEEPER-4023) CLONE - Owasp check failing - Jetty 9.4.32 - CVE-2020-27216 mailing-list, x_refsource_MLIST
- [zookeeper-dev] 20201208 Re: [VOTE] Apache ZooKeeper release 3.5.9 candidate 0 mailing-list, x_refsource_MLIST
- [beam-issues] 20201211 [jira] [Updated] (BEAM-11227) Upgrade beam-vendor-grpc-1_26_0-0.3 to fix CVE-2020-27216 mailing-list, x_refsource_MLIST